.github/workflows/e2e.yaml

@@ -1,11 +1,12 @@
 name: e2e
 
 on:
+  workflow_dispatch:
   pull_request:
   push:
     branches:
       - main
-
+      - "feature/**"
 jobs:
   kind:
     runs-on: ubuntu-latest
@@ -511,6 +512,36 @@ jobs:
             exit 1
           fi
           kubectl -n helm-system delete -f config/testdata/post-renderer-kustomize
+      - name: Boostrap CRDs Upgrade Tests
+        if: ${{ startsWith(github.ref, 'refs/tags/') || startsWith(github.ref, 'refs/heads/') }}
+        run: |
+          REF=${{ github.ref }}
+          if echo "$REF" | grep 'refs/tags/'; then 
+            TYPE=tag
+            REF=${REF#refs/tags/}
+          else
+            TYPE=branch
+            if echo "$REF" | grep 'refs/pull/'; then 
+              REF=${REF#refs/pull/}
+            else
+              REF=${REF#refs/heads/}
+            fi
+          fi
+          echo "$HEAD_REF,$CURR_REF -> $REF of type $TYPE"
+          echo "helm install --namespace default --set $TYPE=$REF --set url=https://github.com/${{ github.repository }} this config/testdata/charts/crds/bootstrap"
+          helm install --namespace default --set $TYPE=$REF --set url=https://github.com/${{ github.repository }} this config/testdata/charts/crds/bootstrap
+          kubectl -n default apply -f config/testdata/crds-upgrade/init
+          kubectl -n default wait helmreleases/crds-upgrade-test --for=condition=ready --timeout=2m
+      - name: CRDs Upgrade Test Create
+        if: ${{ startsWith(github.ref, 'refs/tags/') || startsWith(github.ref, 'refs/heads/') }}
+        run: |
+          kubectl -n default apply -f config/testdata/crds-upgrade/create
+          kubectl -n default wait helmreleases/crds-upgrade-test --for=condition=ready --timeout=2m
+      - name: CRDs Upgrade Test CreateReplace
+        if: ${{ startsWith(github.ref, 'refs/tags/') || startsWith(github.ref, 'refs/heads/') }}
+        run: |
+          kubectl -n default apply -f config/testdata/crds-upgrade/create-replace
+          kubectl -n default wait helmreleases/crds-upgrade-test --for=condition=ready --timeout=2m
       - name: Logs
         run: |
           kubectl -n helm-system logs deploy/source-controller

.github/workflows/scan.yaml

@@ -0,0 +1,55 @@
+name: Scan
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  schedule:
+    - cron: '18 10 * * 3'
+
+jobs:
+  fossa:
+    name: FOSSA
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Run FOSSA scan and upload build data
+        uses: fossa-contrib/fossa-action@v1
+        with:
+          # FOSSA Push-Only API Token
+          fossa-api-key: 5ee8bf422db1471e0bcf2bcb289185de
+          github-token: ${{ github.token }}
+
+  snyk:
+    name: Snyk
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    steps:
+      - uses: actions/checkout@v2
+      - name: Run Snyk to check for vulnerabilities
+        uses: snyk/actions/golang@master
+        continue-on-error: true
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          args: --sarif-file-output=snyk.sarif
+      - name: Upload result to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@v1
+        with:
+          sarif_file: snyk.sarif
+
+  codeql:
+    name: CodeQL
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v1
+        with:
+          languages: go
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v1
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v1

CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 0.10.0
+
+**Release date:** 2021-04-21
+
+This prerelease introduces support for defining a `CRDsPolicy` in the
+`HelmReleaseSpec`, `Install` and `Upgrade` objects, while deprecating
+the `SkipCRDs` fields.
+
+Supported policies:
+
+* `Skip`: Do neither install nor replace (update) any CRDs.
+* `Create`: New CRDs are created, existing CRDs are neither updated nor
+  deleted.
+* `CreateReplace`: New CRDs are created, existing CRDs are updated
+  (replaced) but not deleted.
+
+In case `CreateReplace` is used as an `Upgrade` policy, Custom Resource
+Definitions are applied by the controller before a Helm upgrade is
+performed. On rollbacks, the Custom Resource Definitions are left
+untouched and **not** rolled back.
+
+The `ValuesFile` field in the `HelmChart` template has been deprecated
+in favour of the new `ValuesFiles` field.
+
+Features:
+* Initial support for CRDs (upgrade) policies
+  [#250](https://github.com/fluxcd/helm-controller/pull/250)
+  [#254](https://github.com/fluxcd/helm-controller/pull/254)
+* Add `ValuesFiles` to `HelmChart` spec
+  [#252](https://github.com/fluxcd/helm-controller/pull/252)
+
+Improvements:
+* Update Helm to v3.5.4
+  [#253](https://github.com/fluxcd/helm-controller/pull/253)
+* Update dependencies
+  [#251](https://github.com/fluxcd/helm-controller/pull/251)
+  [#253](https://github.com/fluxcd/helm-controller/pull/253)
+
+Fixes:
+* docs: minor `createNamespace` placement fix
+  [#246](https://github.com/fluxcd/helm-controller/pull/246)
+
 ## 0.9.0
 
 **Release date:** 2021-03-26

README.md

@@ -1,5 +1,6 @@
 # helm-controller
 
+[![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/4784/badge)](https://bestpractices.coreinfrastructure.org/projects/4784)
 [![e2e](https://github.com/fluxcd/helm-controller/workflows/e2e/badge.svg)](https://github.com/fluxcd/helm-controller/actions)
 [![report](https://goreportcard.com/badge/github.com/fluxcd/helm-controller)](https://goreportcard.com/report/github.com/fluxcd/helm-controller)
 [![license](https://img.shields.io/github/license/fluxcd/helm-controller.svg)](https://github.com/fluxcd/helm-controller/blob/main/LICENSE)

api/go.mod

@@ -4,8 +4,8 @@ go 1.15
 
 require (
 	github.com/fluxcd/pkg/apis/kustomize v0.0.1
-	github.com/fluxcd/pkg/apis/meta v0.8.0
-	github.com/fluxcd/pkg/runtime v0.10.1
+	github.com/fluxcd/pkg/apis/meta v0.9.0
+	github.com/fluxcd/pkg/runtime v0.11.0
 	k8s.io/apiextensions-apiserver v0.20.2
 	k8s.io/apimachinery v0.20.2
 	sigs.k8s.io/controller-runtime v0.8.3

api/go.sum

@@ -90,10 +90,10 @@ github.com/evanphx/json-patch v4.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLi
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fluxcd/pkg/apis/kustomize v0.0.1 h1:TkA80R0GopRY27VJqzKyS6ifiKIAfwBd7OHXtV3t2CI=
 github.com/fluxcd/pkg/apis/kustomize v0.0.1/go.mod h1:JAFPfnRmcrAoG1gNiA8kmEXsnOBuDyZ/F5X4DAQcVV0=
-github.com/fluxcd/pkg/apis/meta v0.8.0 h1:wqWpUsxhKHB1ZztcvOz+vnyhdKW9cWmjFp8Vci/XOdk=
-github.com/fluxcd/pkg/apis/meta v0.8.0/go.mod h1:yHuY8kyGHYz22I0jQzqMMGCcHViuzC/WPdo9Gisk8Po=
-github.com/fluxcd/pkg/runtime v0.10.1 h1:NV0pe6lFzodKBIz0dT3xkoR0wJnTCicXwM/v/d5T0+Y=
-github.com/fluxcd/pkg/runtime v0.10.1/go.mod h1:JD0eZIn5xkTeHHQUWXSqJPIh/ecO0d0qrUKbSVHnpnw=
+github.com/fluxcd/pkg/apis/meta v0.9.0 h1:rxW69p+VmJCKXXkaRYnovRBFlKjd+MJQfm2RrB0B4j8=
+github.com/fluxcd/pkg/apis/meta v0.9.0/go.mod h1:yHuY8kyGHYz22I0jQzqMMGCcHViuzC/WPdo9Gisk8Po=
+github.com/fluxcd/pkg/runtime v0.11.0 h1:FPsiu1k5NQGl2tsaXH5WgSmrOMg7o44jdOP0rW/TI1Y=
+github.com/fluxcd/pkg/runtime v0.11.0/go.mod h1:ZjAwug6DBLXwo9UdP1/tTPyuWpK9kZ0BEJbctbuEB1o=
 github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=

api/v2beta1/helmrelease_types.go

@@ -246,9 +246,19 @@ type HelmChartTemplateSpec struct {
 	// +optional
 	Interval *metav1.Duration `json:"interval,omitempty"`
 
-	// Alternative values file to use as the default chart values, expected to be a
-	// relative path in the SourceRef. Ignored when omitted.
+	// Alternative list of values files to use as the chart values (values.yaml
+	// is not included by default), expected to be a relative path in the SourceRef.
+	// Values files are merged in the order of this list with the last file overriding
+	// the first. Ignored when omitted.
 	// +optional
+	ValuesFiles []string `json:"valuesFiles,omitempty"`
+
+	// Alternative values file to use as the default chart values, expected to
+	// be a relative path in the SourceRef. Deprecated in favor of ValuesFiles,
+	// for backwards compatibility the file defined here is merged before the
+	// ValuesFiles items. Ignored when omitted.
+	// +optional
+	// +deprecated
 	ValuesFile string `json:"valuesFile,omitempty"`
 }
 
@@ -325,9 +335,34 @@ type Install struct {
 
 	// SkipCRDs tells the Helm install action to not install any CRDs. By default,
 	// CRDs are installed if not already present.
+	//
+	// Deprecated use CRD policy (`crds`) attribute with value `Skip` instead.
+	//
+	// +deprecated
 	// +optional
 	SkipCRDs bool `json:"skipCRDs,omitempty"`
 
+	// CRDs upgrade CRDs from the Helm Chart's crds directory according
+	// to the CRD upgrade policy provided here. Valid values are `Skip`,
+	// `Create` or `CreateReplace`. Default is `Create` and if omitted
+	// CRDs are installed but not updated.
+	//
+	// Skip: do neither install nor replace (update) any CRDs.
+	//
+	// Create: new CRDs are created, existing CRDs are neither updated nor deleted.
+	//
+	// CreateReplace: new CRDs are created, existing CRDs are updated (replaced)
+	// but not deleted.
+	//
+	// By default, CRDs are applied (installed) during Helm install action.
+	// With this option users can opt-in to CRD replace existing CRDs on Helm
+	// install actions, which is not (yet) natively supported by Helm.
+	// https://helm.sh/docs/chart_best_practices/custom_resource_definitions.
+	//
+	// +kubebuilder:validation:Enum=Skip;Create;CreateReplace
+	// +optional
+	CRDs CRDsPolicy `json:"crds,omitempty"`
+
 	// CreateNamespace tells the Helm install action to create the
 	// HelmReleaseSpec.TargetNamespace if it does not exist yet.
 	// On uninstall, the namespace will not be garbage collected.
@@ -421,6 +456,21 @@ func (in InstallRemediation) RetriesExhausted(hr HelmRelease) bool {
 	return in.Retries >= 0 && in.GetFailureCount(hr) > int64(in.Retries)
 }
 
+// CRDsPolicy defines the install/upgrade approach to use for CRDs when
+// installing or upgrading a HelmRelease.
+type CRDsPolicy string
+
+const (
+	// Skip CRDs do neither install nor replace (update) any CRDs.
+	Skip CRDsPolicy = "Skip"
+	// Create CRDs which do not already exist, do not replace (update) already existing
+	// CRDs and keep (do not delete) CRDs which no longer exist in the current release.
+	Create CRDsPolicy = "Create"
+	// Create CRDs which do not already exist, Replace (update) already existing CRDs
+	// and keep (do not delete) CRDs which no longer exist in the current release.
+	CreateReplace CRDsPolicy = "CreateReplace"
+)
+
 // Upgrade holds the configuration for Helm upgrade actions for this
 // HelmRelease.
 type Upgrade struct {
@@ -463,6 +513,26 @@ type Upgrade struct {
 	// upgrade action when it fails.
 	// +optional
 	CleanupOnFail bool `json:"cleanupOnFail,omitempty"`
+
+	// CRDs upgrade CRDs from the Helm Chart's crds directory according
+	// to the CRD upgrade policy provided here. Valid values are `Skip`,
+	// `Create` or `CreateReplace`. Default is `Skip` and if omitted
+	// CRDs are neither installed nor upgraded.
+	//
+	// Skip: do neither install nor replace (update) any CRDs.
+	//
+	// Create: new CRDs are created, existing CRDs are neither updated nor deleted.
+	//
+	// CreateReplace: new CRDs are created, existing CRDs are updated (replaced)
+	// but not deleted.
+	//
+	// By default, CRDs are not applied during Helm upgrade action. With this
+	// option users can opt-in to CRD upgrade, which is not (yet) natively supported by Helm.
+	// https://helm.sh/docs/chart_best_practices/custom_resource_definitions.
+	//
+	// +kubebuilder:validation:Enum=Skip;Create;CreateReplace
+	// +optional
+	CRDs CRDsPolicy `json:"crds,omitempty"`
 }
 
 // GetTimeout returns the configured timeout for the Helm upgrade action, or the